Drupal CMS News Digest
developments tricks, articles and reviews from Drupal specialists
Webpro Company blog: Drupal CMS 1 to Drupal CMS 2 upgrade
Drupal CMS 2.0 brings a new starting point, Canvas and site templates, but an existing site created from Drupal CMS 1 does not automatically become the same thing. Before changing it, you need to understand what the site actually uses. Drupal CMS 2.0 raises an obvious question: if a site started from Drupal CMS 1, can it simply be upgraded to Drupal CMS 2? The short answer: carefully. Drupal CMS is not a product version in the same sense as a Drupal Core major version. The Drupal CMS project page describes it as a starting point for new sites. Once a site has been created, what you have is a Drupal site with selected modules, configuration and content. That means Drupal CMS 1 to 2 should not be treated as just a Composer command. It should be treated as a technical change to an…
https://webpro.company/blog/dr
Webpro Company blog: Drupal admin interface as an editorial workbench
Drupal is a strong platform for complex digital services, but its long-term value depends on how well people can use it every day. The admin interface should support the editorial team, not slow it down. The admin interface is part of service quality Public-facing user experience usually receives most of the attention. That is understandable. Visitors, residents, students, customers or partners see the public website first. But there is another important user group: the people who create, update, translate, review, publish and archive content. When their work happens in a slow or confusing admin interface, the impact appears quickly: content is updated less often; errors remain visible for longer; editors need more support; developers are asked to handle changes the content team should…
https://webpro.company/blog/dr
DrupalCon News & Updates: Why DrupalCon Rotterdam Is Worth Attending
DrupalCon Rotterdam is one of those events that naturally attracts attention across the Drupal ecosystem. Not only because it brings the community together, but because it creates a space where technology, strategy, contribution and real-world digital projects meet.
For anyone working with Drupal, open source or digital experience platforms, the question is not just “what happens at DrupalCon?”, but it might be: “If you have never been before, why should this be the year to go?”
Image
Photo by Joris Vercammen
Why Rotterdam? Rotterdam feels like a strong fit for an event like DrupalCon. It is a city known for innovation, architecture, international connections and a forward-looking mindset — qualities that align naturally with the spirit of the Drupal community. Bringing DrupalCon to Rotterdam creates an opportunity to connect the European Drupal community in a dynamic and accessible setting. It also gives professionals from different markets the chance to meet, exchange perspectives and discuss how Drupal continues to evolve in a fast-changing digital landscape.
Learning from real experience One of the strongest reasons to attend DrupalCon is the quality of the knowledge shared by the...
Why Rotterdam? Rotterdam feels like a strong fit for an event like DrupalCon. It is a city known for innovation, architecture, international connections and a forward-looking mindset — qualities that align naturally with the spirit of the Drupal community. Bringing DrupalCon to Rotterdam creates an opportunity to connect the European Drupal community in a dynamic and accessible setting. It also gives professionals from different markets the chance to meet, exchange perspectives and discuss how Drupal continues to evolve in a fast-changing digital landscape.
Learning from real experience One of the strongest reasons to attend DrupalCon is the quality of the knowledge shared by the...
https://events.drupal.org/rott
Security advisories: Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009
Project: Drupal coreDate: 2026-June-17Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Improper validationAffected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.*CVE IDs: CVE-2026-55808Description: The JSON:API and REST modules allow you to upload image files to image fields.
The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.
Certain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior.Solution: Install the latest version:
Drupal 11
If you use Drupal 11.3.x, update to Drupal 11.3.12.
If you use Drupal 11.2.x, update to Drupal 11.2.14.
Drupal 10
If you use Drupal 10.6.x, update to Drupal 10.6.11.
If you use Drupal 10.5.x, update to Drupal 10.5.12.
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)Reported By:
cantina_security
Fixed By:
Björn Brala (bbrala)
Kim Pepper (kim.pepper)
Lee Rowlands (larowlan) of the Drupal Security Team...
https://www.drupal.org/sa-core
Security advisories: Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008
Project: Drupal coreDate: 2026-June-17Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Server-side request forgeryAffected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.*CVE IDs: CVE-2026-55807Description: The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery.
The URL discovery code could be leveraged to trick Drupal into making server-side requests to any URL.Solution: Install the latest version:
Drupal 11
If you use Drupal 11.3.x, update to Drupal 11.3.12.
If you use Drupal 11.2.x, update to Drupal 11.2.14.
Drupal 10
If you use Drupal 10.6.x, update to Drupal 10.6.11.
If you use Drupal 10.5.x, update to Drupal 10.5.12.
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)
Required site changes for URL discovery
Most users of the oEmbed functionality in Drupal likely use providers.json to define known providers (such as YouTube and Vimeo) for embedding content.
If you are using URL discovery, you now need to set a list of trusted oEmbed discovery hosts in settings.php.
This is an array...
https://www.drupal.org/sa-core
Security advisories: Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007
Project: Drupal coreDate: 2026-June-17Security risk: Less critical 9 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:DefaultVulnerability: Cache poisoning and open redirectAffected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.*CVE IDs: CVE-2026-55806Description: Drupal core ships a rebuild.php front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in an unexpected condition.
This script doesn't correctly check the Host header against the list of trusted host patterns. This could result in cache poisoning or a redirect to an attacker-controlled domain.Solution: Install the latest version:
Drupal 11
If you use Drupal 11.3.x, update to Drupal 11.3.12.
If you use Drupal 11.2.x, update to Drupal 11.2.14.
Drupal 10
If you use Drupal 10.6.x, update to Drupal 10.6.11.
If you use Drupal 10.5.x, update to Drupal 10.5.12.
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)Reported By:
Melih Acikoz
Michael Winser (michaelwinser)
Willem Drupal enthousiast (willempje2)
Fixed By:
Lee Rowlands (larowlan) of the Drupal Security Team
Coordinated By: catch (catch) of the Drupal...
https://www.drupal.org/sa-core
Security advisories: Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006
Project: Drupal coreDate: 2026-June-17Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Gadget chainAffected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.*CVE IDs: CVE-2026-55804Description: Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application deserializes untrusted data due to another vulnerability.
This issue is not directly exploitable.
This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize().Solution: Install the latest version:
Drupal 11
If you use Drupal 11.3.x, update to Drupal 11.3.12.
If you use Drupal 11.2.x, update to Drupal 11.2.14.
Drupal 10
If you use Drupal 10.6.x, update to Drupal 10.6.11.
If you use Drupal 10.5.x, update to Drupal 10.5.12.
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)Reported By:
Michael...
https://www.drupal.org/sa-core
Security advisories: Drupal core - Critical - PHP object injection - SA-CORE-2026-005
Project: Drupal coreDate: 2026-June-17Security risk: Critical 18 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: PHP object injectionAffected versions: <10.5.12 || >=10.6.0 <10.6.11 || >=11.2.0 <11.2.14 || >=11.3.0 <11.3.12 || 11.0.* || 11.1.*CVE IDs: CVE-2026-55803Description: SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services.
The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain rare circumstances, potentially resulting in PHP Object Injection.
This vulnerability is mitigated by the fact that in order to be exploitable:
A site must use an entity reference field type that stores a serialized property.
An attacker must have permission to write to the entity via JSON:API.
No field type shipped with Drupal core meets these criteria, and contributed or user-created field types that do appear to be extremely unusual. This update protects all such fields; no changes are required in contributed modules.
JSON:API is read-only by default, so sites are only affected if they have enabled write access (either through administrator configuration or the installation of a contributed or custom module that enables write...
https://www.drupal.org/sa-core
Très Bien Blog: An opportunity to help Web standards move in a good direction
An opportunity to help Web standards move in a good direction Drupal now ships with HTMX, and there is currently a proposal to add a few of the building blocks into the HTML specification. The effort is nicknamed the triptych and the goal is to add three new HTML features: theodore
June 17, 2026
https://tresbien.tech/blog/opp
Nonprofit Drupal posts: June 2026 Drupal for Nonprofits Chat
Join us THURSDAY, June 18 at 1pm ET / 10am PT, for our regularly scheduled call to chat about all things Drupal and nonprofits. (Convert to your local time zone.)
We don't have anything specific on the agenda this month, so we'll have plenty of time to discuss anything that's on our minds at the intersection of Drupal and nonprofits. Got something specific you want to talk about? Feel free to share ahead of time in our collaborative Google document at https://nten.org/drupal/notes!
All nonprofit Drupal devs and users, regardless of experience level, are always welcome on this call.
This free call is sponsored by NTEN.org and open to everyone.
Information on joining the meeting can be found in our collaborative Google document.
https://www.drupal.org/communi
Dries Buytaert: AI and the great CMS unbundling
The question I get most these days is: did AI kill the CMS? Should we still invest in a CMS, switch to AI agents, or wait until the market becomes clearer?
At a friend's birthday party recently, I was talking with engineers and startup CEOs. They were all smart people, but none of them worked in the CMS industry. From where they sat, AI seemed to make the CMS obsolete.
I understand why. AI can now generate copy, design pages, write code, translate content, and assemble websites. If that is what you think a CMS is for, it does look like the CMS is in trouble.
They may be right about one part of the CMS market. But I think they are wrong about the larger picture.
To see why, it helps to separate what a content management system, or CMS, does into two planes: the control plane and the execution plane.
The control plane governs content: who can edit it, what gets approved, which version is canonical, how translations move through workflow, and where content can be used.
The execution plane creates, assembles, and delivers that content into websites, mobile apps, feeds, and other customer experiences.
AI is unbundling these two planes. It is commoditizing the execution plane while making the control plane more valuable. That is why I think AI is killing one corner of the CMS market, but making the CMS more critical everywhere else.
This post is a companion to AI and the great...
https://dri.es/ai-and-the-grea
AI and the great CMS unbundling
The question I get most these days is: did AI kill the CMS? Should we still invest in a CMS, switch to AI agents, or wait until the market becomes clearer?
At a friend's birthday party recently, I was talking with engineers and startup CEOs. They were all smart people, but none of them worked in the CMS industry. From where they sat, AI seemed to make the CMS obsolete.
I understand why. AI can now generate copy, design pages, write code, translate content, and assemble websites. If that is what you think a CMS is for, it does look like the CMS is in trouble.
They may be right about one part of the CMS market. But I think they are wrong about the larger picture.
To see why, it helps to separate what a content management system, or CMS, does into two planes: the control plane and the execution plane.
The control plane governs content: who can edit it, what gets approved, which version is canonical, how translations move through workflow, and where content can be used.
The execution plane creates, assembles, and delivers that content into websites, mobile apps, feeds, and other customer experiences.
AI is unbundling these two planes. It is commoditizing the execution plane while making the control plane more valuable. That is why I think AI is killing one corner of the CMS market, but making the CMS more critical everywhere else.
This post is a companion to AI and the great...
https://dri.es/ai-and-the-grea
The 2026 redesign of dri.es
I spent last weekend redesigning dri.es, squeezed between hosting one barbecue, going to another, and driving to the Belgian beach.
I didn't write a single line of HTML or CSS myself. I told Claude Code what I wanted, and it generated a Drupal theme.
The new design is still minimalist, like the previous one. I prefer simple websites that focus on the content.
Vanessa thinks it is too plain. Given our respective records on style and fashion, she is almost certainly right.
Besides a new design, I also added a photo strip to the main page, cleaned up the sensor pages, added charts to the tag pages, and more.
So if the new design feels a little too plain, you may still find a few new things to enjoy.
https://dri.es/the-2026-redesi
The Drop Times: ECA, FlowDrop, and Maestro Maintainers Explore Shared Drupal Automation Layer
Maintainers of ECA, FlowDrop, and Maestro are discussing whether Drupal automation tools can share backend contracts without merging their interfaces or use cases. Based on details Shibin Das shared with The DropTimes, the planning-stage work focuses on common graph models, shared language, and reusable processor patterns. The discussion matters for developers who now rebuild similar automation logic across different Drupal workflow systems and for teams that need governance, permissions, and observability to remain close to Drupal.
https://www.thedroptimes.com/7
Electric Citizen: Subsite and Microsites
Working with larger organizations, it’s common to want to split off a section of content into its own smaller site.A city may want a separate site for a particular construction project, or a university may want one for a capital campaign. Marketing teams often need smaller, dedicated sites for communication and promotion.They’re usually not complex. Often it’s a matter of a different navigation, some different branding, and a unique URL. But they still need to be designed, built, hosted, and managed — somewhere. And they’re usually needed quickly (like, now).Whether you’re launching your first or looking for a better way to manage the ones you have, let’s explore these “mini-websites” and the best options for your organization.
https://electriccitizen.com/re
Specbee: 8 Drupal AI modules worth using in 2026
Going AI on Drupal? Here’s a practical guide about 8 Drupal AI modules worth using in 2026 - what each one does, who it's built for, and where the rough edges are.
https://www.specbee.com/blogs/
